And it keeps growing: Yahoo reveals that 3 billion user accounts have been at risk since...

[Greg S]

A large data breach of Yahoo accounts in 2013, before Verizon acquired the company caused enough turmoil, but the damage apparently is not yet over. Originally, 1 billion people were thought to have been affected by the security breach, but the numbers keep rising. Over 3 billion people may be affected by the breach, making this the largest theft of user information to date.

Yahoo required users that were identified as potentially affected by the hack to change their passwords in 2016. Now all Yahoo users are believed to be potentially affected by the theft of encrypted data that occurred in 2013. Fortunately, no personally identifiable clear text data was leaked, but weak passwords and ever increasing compute power could make it very easy to break security methods employed.

At the time of the data theft, Yahoo was using the MD5 hash algorithm to protect user account passwords. Since then, MD5 has been determined to be cryptographically insecure and should not be utilized for new systems. Following the security breach, Yahoo began a transition to the more secure Bcrypt hashing algorithm with added salts and multiple passes through a hash function.

If you were a Yahoo user back in 2013, any passwords and security questions used then should be considered insecure for future use. Remember that security question answers do not have to actually answer the question being asked. Any phrase can be used as a security question answer as long as you can remember it to help keep your account secure.

Permalink to story.

https://www.techspot.com/news/71247-yahoo-reveals-3-billion-user-accounts-have-risk.html

 

[Puiu]

Just how many beers did they exchange between them?

 

[Squid Surprise]

I think it's important to clarify that it's 3 billion user ACCOUNTS that are at risk... I highly doubt that 3 billion different people use Yahoo....

The title states this - but the article itself says "people"...

 

[Theinsanegamer]

"Yahoo to Equifax: hold my beer"

Equifax to yahoo: "take back your pi$$water beer"

The two are not really comparable. Yahoo was compromised, but resetting your password was enough to fix the issue. At the end of the day, it was a compromised email address, and 15 minutes spent resetting bank, email, and other passwords remedied the issue.

Equifax could not be changed with a simple password, the people affected had no ability to prevent the matter, and the effects will affect some people their entire lives. That SS number could be abused 15 years from now, and there is nothing that can be done about it. And now the IRS has awarded equifax with a 7+ million dollar contract to "combat data fraud" which is just ridiculous.

 

[Solar Flair]

I remember few years ago when I try to recover my password from a service. The site show me about 10 security questions and expect me to pick one to answer... what?! I have to remember what question I am using too? damn...

 

[Reehahs]

I remember few years ago when I try to recover my password from a service. The site show me about 10 security questions and expect me to pick one to answer... what?! I have to remember what question I am using too? damn...

That might accidentally be an awesome feature.

 

[Uncle Al]

I suppose that should give them some special recognition for their mastery of hiding longer than anyone else .... Perhaps it's finally time to change that name from Yahoo to OMG.

 

[Kibaruk]

What? Are there still people using Yahoo?

Even back in the 90s their ads were rubbish.

 

[Cal Jeffrey]

I've always had a prejudice against Yahoo!. Maybe it was its stupid "Yaaaahoooooo!" commercials in the 90s. Maybe it was because it annoyed me that when I used Yahoo!'s name in a written sentence it made it look like I was ending the sentence. Maybe it was because my ex had an account and I didn't want to have anything to do with anything she had to do with.

Now I'm thinking maybe it was just intuition.

 

[senketsu]

I think it's important to clarify that it's 3 billion user ACCOUNTS that are at risk... I highly doubt that 3 billion different people use Yahoo....

The title states this - but the article itself says "people"...

ya gotta watch for those words like "up to" and "maybe" as well as "potentially" and their ilk. They are a licence for writing that can mislead if not read very carefully